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(57) Abstract 

The invention relates to the maintenance of safety devices. Valves and similar automatic mechanical safety devices normally 
maintaining a fixed position are in danger of getting stuck, and consequently may not be fully operable in an emergency situation. In a 
system according to the invention, real-time data indicating the operability of, for example, a valve actuator, is provided. When a fault 
is discovered, it can be localized using online diagnostic tools. A standby state is continuously maintained, as the unit for activating the 
safety function is independent of the unit for monitoring the operability, and the latter is bypassed in an emergency situation. 
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Method and device for verifying the workability of a safety device ' 
Field of the invention 

The invention relates to the maintenance of safety devices. Particularly, the invention per- 
tains to the verification of the correct performance of actuator-controlled safety devices 
comprising movable parts, especially so-called emergency shutdown valves and their control 
devices, in such a manner that neither production continuity nor the standby state of the 
devices is impaired. 

Background of the invention 

In the industry, particularly in the petrochemical process industry, systems are used wherein 
process equipment likely to cause hazards upon failure is provided with valves and other 
mechanical means designed to bring the process quickly into a safe state if preset process 
parameter limits are exceeded. For example, such a system usually includes valves with sin- 
gle-action actuators, the opening or closing of which releases a built-up overpressure, di- 
verts a hazardous process stream into a holding tank, or the like. Hereinafter, such valves 
are referred to as shutdown valves (being emergency valves having a closing or an opening 
function). These valves normally always maintain the same position, like other correspond- 
ing mechanical safety devices, and are consequently at risk for getting stuck if situations 
forcing a shutdown are not, as is hopefully the case, very frequent. The general safety of 
shutdown valves is not considered satisfactory when prior art equipment and methods are 
used. The greatest disadvantage in present systems is, that an existing failure - for example, 
a mechanical component getting stuck - is not necessarily observed when the system is in a 
standby state, and in an emergency situation the system may be impaired or inoperative. 
To verify proper performance, it is common to test e.g. shutdown valves in a manner simu- 
lating a real emergency situation. This practice may in fact cause huge risks, as the work- 
ability of the shutdown valve system is temporarily blocked, and if the device is not properly 
activated, the situation may remain permanent. 

One method of testing a shutdown valve is to mechanically limit its travel, thus preventing it 
from having any significant effect on the process, and check the mobility of the valve within 
certain limits. This procedure requires the use of, for example, a physical key, and activation 
of the emergency system is prevented during the testing procedure, at least as far as the 
relevant unit is concerned. 
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The test is carried out at preset intervals, for example twice a year, but the test only proves 
that the devices are workable at the moment of testing. A fault may develop shortly after the 
tes^t and persist until the next test. This manner of testing is not a reliable way of verifying 
operability of the system. 

Valve diagnostics using present sensor and digital technology is a fast developing field. For 
example, in Finnish patent application 96 2406 and European patent application 95 306546, 
methods are disclosed for surveillance of the condition of control valves using sensors in the 
actuator and control means of the valve and the analysis of signals from said sensors in a 
microprocessor to analyze the workability of the valve unit as a whole. 
As described above, the surveillance of the condition of a valve or other mechanical device 
which is part of a safety system involves certain requirements. 

In Norwegian patent 1523 14, a method and device for testing the function of safety devices 
are disclosed. According to said patent, an emergency shutdown valve or the control relay 
of an electrical motor is periodically tested without affecting the process to which the safety 
system is adapted. By, e.g., temporarily cutting the signal of a solenoid pilot valve affecting 
a shutdown valve, the shutdown valve is shifted e.g. 10 degrees, and the position of the 
shutdown valve is monitored by a sensor or a limit switch. If a malfunction is observed, the 
safety function is activated. The testing sequence is controlled by logic circuitry situated 
outside the field, and implemented by means of timers and standard logic elements. 

Disclosure of the invention 

General description 

A method according to claim 1 has been invented, which provides for the verification of 
error-free operation of a mechanical safety device, for example a shutdown valve, while the 
standby state of the safety system is constantly maintained without impairment. In said 
method, the safety function and the surveillance or diagnostics function are combined in real 
time, the safety function nevertheless having a higher priority than the diagnostics function. 
In a method according to the invention, a component fitted directly to the safety device for 
activating the safety function is controlled by the plant's high-level safety system which is 
responsible for safety operations, or alternatively by a logic unit integrated into the device 
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according to the invention, a diagnostics unit being adapted to said activating component. 
The diagnostics unit is allowed to perform diagnostics not disturbing the process functions 
whenever the process is in a normal state. In an emergency situation, the diagnostics unit is 
bypassed, whereby for example neither a fault or disturbance in the diagnostics testing nor 
an ongoing routine test can impair the safety function. The scope and periodicity of the di- 
agnostics can be programmed into the system in order to achieve a desired level of reliabil- 
ity. 

According to one embodiment of the present invention, a device is provided enabling the 
verification of undisturbed operation of a mechanical safety device while the standby state 
of the safety system is fully maintained. 

The field unit of a safety system according to the invention comprises a microprocessor 
providing for preset self-testing and diagnostics procedures. The field unit further includes a 
control unit providing for the control of an actuator. By means of appropriate communica- 
tions means said control unit is connected to, on the one hand, the high-level safety system 
or the logic unit integrated into the field unit, and on the other hand to the supply of energy 
to the safety device, e.g. a compressed air supply. The high level safety system or the inte- 
grated logic unit activates the safety function directly, bypassing the diagnostics function. 

In addition to said field unit, another main component of the safety system according to the 
present invention is a monitoring unit. The communication link from the high level safety 
system is routed through the monitoring unit. Preferably, the task of the monitoring unit is 
to monitor the status of the field unit on-line, and provide the means for presenting status 
information to the user. 

Detailed description 

The invention is described more closely below with reference to the enclosed drawings, 
wherein 

- Figure 1 is a schematic representation of a system for implementing the method of the 
present invention; 

- Figure 2 is a representation of a field unit according to the present invention connected to 
a valve actuator in a normal situation; 

- Figure 3 is a representation of a field unit and actuator according to the present invention 
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in an emergency situation. 



In figure 1,(1) represents a monitoring unit of a system according to present invention and 
(2) is a field unit comprising a control unit (7) according to the invention, a communication 
interface (3), an electronics unit (19) including a microprocessor, and the required sensors 
and pneumatic components (not shown). The control unit (7) controls a safety device (24) 
comprising an actuator (8) and a valve (22). The communication between monitoring unit 
(1) and control unit (7) is preferably maintained through communication link (5) as de- 
scribed below. Communication link (5) can be analogous or digital or a combination of both 
by means of, for example, a paired cable. As the field area usually is an explosion-risk area, 
in this case the system includes a barrier unit (6). 

Field unit (2) is supplied with power voltage, preferably 24 V, from the high level safety 
system (18) in charge of safety functions or, in case the safety system according to the pres- 
ent invention includes a logic unit, from a digital communication link. Preferably, the moni- 
toring unit (1) is provided with indicator lights reflecting the state of the field unit, con- 
trolled by the signal provided by communication link (5) and relay outputs (21) correspond- 
ing to said indicator lights. For example, a green light may indicate the signal being normal 
and the safety system according to the invention being in a standby state. At programmable 
intervals, the microprocessor included in electronics unit (19) carries out diagnostics. 
Thereby the signal in link (5) changes, as indicated by, for example, a yellow light. When the 
diagnostics has revealed a fault, this is correspondingly indicated by, for example, a red 
light. The signals corresponding to the indicator lights can be forwarded through, e.g., relay 
outputs (21). The performance of the light indicators and the relay outputs may for example 
be checked by means of a local push button on the monitoring unit. 

Preferably, the monitoring unit (1) is connected to a computer (23) running a safety system 
maintenance program, enabling the determination of the character of a fault by analysis of 
data stored by the diagnostics system. The communication required by this function is pref- 
erably also provided by communication link 5. 

Further, the monitoring unit housing preferably includes means (for example, a keyboard 
and a LED display) for local control of the microprocessor included in electronics unit (19). 
The task of the communication interface (3) is to separate the signals, described below, 
transmitted by communication link (5). In addition, it may incorporate the logic unit inte- 
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grated in the field unit. 

At the communication interface (3) the communication link splits into a direct link (10) to 
thq control unit (7) and a link (25) to electronics unit (19). Further, the electronics unit (19) 
is connected (26) to the control unit. 

During normal operation, tests on the control unit (7) and the safety device (24) are per- 
formed at defined intervals under the control of the program residing in the microprocessor 
within the electronics unit (19). Tests can also be performed ad hoc by means of computer 
(23). 

In a situation where the emergency function is activated, the signal is carried directly from 
the high level safety system (1 8) via links (5) and (10) to control unit (7), for example in a 
manner described below. Alternatively, a logic unit integrated into communication interface 
(3) may transmit a signal along link (10) directly to control unit (7). 

In Figure 2, (7) is the main valve of field unit (2). The figure represents a normal operating 
situation: As connection (10) is live with 24 V control voltage, pneumatic control valve 
(1 1) stays closed and slide (14) stays pushed to the right against spring (15). Hereby the 
operating air pressure of the actuator acts freely through connections (12) and (13), and the 
valve actuator cylinder (8) is pressurized, spring (9) being compressed. Microprocessor (17) 
within electronics unit (19) is allowed to carry out diagnostics by means of pneumatic con- 
trol valve (16) as described below. 

Figure 3 represents a situation where the safety function has been activated. The voltage in 
connection (10) has fallen to zero, and the pressure is released through valve (1 1). Spring 
(15) pushes slide (14) to the left, the actuator pressure is released through aperture (20), 
and actuator (8), by means of the energy in compressed spring (9), brings the shutdown 
valve into its safety position, which may be open or closed. The function of microprocessor 
(17) has no influence on the situation. Preferably, the microprocessor is de-energized in this 
situation, as it is supplied with power from the same connection as control valve (11). Natu- 
rally, the field electronics unit (19) of the shutdown valve is normally provided with non- 
volatile memory circuits able to store measurement data relating to the safety function be- 
fore power disappears. 
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Microprocessor (17) receives at least the following input data: 

- position of the control valve 

- position of the shutdown valve 

- cylinder pressure of actuator 

- commands entered from a local keyboard 

Microprocessor (17 ) can be programmed to perform diagnostics functions at preset inter- 
vals, for example 15 ms - one week. In the preferable embodiment described below, these 
comprise a so-called hysteresis test. Before starting the test, the microprocessor transmits, 
by altering the signal of communication link (5), a message to monitoring unit (1) which 
shifts to indicate that a test is in progress. Next, the control pressure is lowered by means of 
valve (16) during a previously defined time interval to a preset level and back to the starting 
level, whereby a corresponding decrease in actuator pressure shall be observed within a 
defined time delay, as indicated by sensors (not shown). As the pressure is decreased and 
returned to the initial state within a defined time interval, a corresponding change in shut- 
down valve position shall be observed within a defined time delay. 
If target values are not attained, microprocessor (17) transmits, by altering the signal in 
communication link (5), a message to monitoring unit (1) which shifts to indicate failure 
alarm. The movements of the shutdown valve during the test cycle are limited in order not 
to interfere with the process. 

In addition to the test described above to verify the mechanical workability of a shutdown 
valve, diagnostics include other functions outside the scope of the present invention, e.g. 
internal diagnostics of electronic components and characterization of valve leakage and 
valve movement using a separate acoustic sensor. 

According to an embodiment of the present application, all communication between field 
and control room can take place along the same communication link (5). Preferably, this is a 
paired cable for 

a) maintaining the control voltage, e.g. 24 V, of the high level safety system (18), simulta- 
neously maintaining the standby state of field unit (2); 

b) controlling the indicator lights and relay outputs of monitoring unit (1) by means of sig- 
nal changes 
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c) communication between the safety system maintenance program in computer (23) and' 
electronics unit (19) using, for example, the HART protocol well known to persons skilled 
in the art. 

5 The above arrangement is preferable because retrofitting of the system into existing plants is 
convenient. 

In contrast to the method and device disclosed in NO 1523 14, the present invention pro- 
vides the following advantages: 
10 - The "intelligent" components are located in the field, which enables the connection of 
safety devices to a field bus system. 

- If a malfunction is observed, the safety function is not unconditionally activated, but 
maintenance is possible and the plant may remain in operation. 

- The main standby signal (e.g., the 24 V main voltage in the above example) is not affected 
15 during testing, but direct contact with the system in charge of safety functions is always 

maintained. Testing is carried out using a dedicated signal and separate wiring. 

- Running individual, standalone tests is possible, as well as detailed diagnostics involving 
several sensors, optionally in the form of self-diagnostics 

- Wiring to field unit is kept at a minimum; often, an existing paired cable is sufficient. 

20 

The invention is described herein using a system implemented to a valve, but it is obvious 
that the invention may, without deviating from its general concept, be implemented in other 
safety devices comprising mechanical parts, not necessarily controlling fluid flows but pro- 
viding a safe state by other means. 
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Claims 

1 . A method for verifying the workability of a safety device and the safety system control- 
ling said device, wherein said safety device is provided with means for performing opera- 
tions for verifying the mobility of movable parts and for verifying the workability of electri- 
cal units of the safety system, characterized by the signal maintaining the standby state of 
the safety function being unaffected by the operations performed for verifying the mobility 
of movable parts and for verifying the workability of electrical units of the safety system. 

2. A method according to claim 1, characterized by the procedure for verifying the mobil- 
ity of moving parts and the workability of electrical components in the safety system being 
performed continuously according to a preset schedule, or as single events by means of a 
communication link. 

3. Device for the verification of the workability of a safety device comprising movable 
parts, said device comprising means for verifying the workability of said moving parts, 
characterized by the device further comprising means for activating the safety function, the 
means for activating the safety function being, with respect to the safety function, independ- 
ent of the means for verifying workability. 

4. Device according to claim 3, characterized by the means for activating the safety func- 
tion comprising a field unit provided on the safety device and a monitoring unit situated 
elsewhere, and a communication link between said units, the signals from the means for 
verifying workability and the signals from the safety system both being transmitted in said 
communication link. 

5. Device according to any claim 3 or 4, characterized by the safety device comprising an 
actuator and a valve. 
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